CVE-2026-39446: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Kapee 1.7.0 versions...

Drupal core - Critical - PHP object injection - SA-CORE-2026-005

SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services. The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain...

CVE-2026-40756: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Zoya = 1.4 versions...

CVE-2026-40755: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in TechLink = 1.3 versions...

CVE-2026-39567: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Santé = 1.5.1 versions...

CVE-2026-49108: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Moderno 1.43 versions...

CVE-2026-40752: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Manufaktur Solutions = 1.1.1 versions...

CVE-2026-40738: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Eldon = 1.4.1 versions...

CVE-2026-39560: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Hiroshi = 1.5.1 versions...

CVE-2026-39556: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Konsept = 1.9 versions...

CVE-2026-39445: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Alukas 3.0.0 versions...

CVE-2026-39442: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in PressMart = 1.2.26 versions...

CVE-2025-69111: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Reisen = 1.4.1 versions...

CVE-2026-54806: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...

CVE-2026-49107: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Thrive Apprentice 10.8.10.2 versions...

CVE-2026-49075: Deserialization of Untrusted Data

Contributor PHP Object Injection in JetEngine = 3.8.9.1 versions...

CVE-2026-42380: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in AI Lab 5.4.2 versions...

CVE-2026-40761: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Valeska = 1.2.2 versions...

CVE-2026-40758: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Léonie = 1.2.1 versions...

CVE-2026-40753: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in EasyMeals = 1.5.1 versions...